CN1691582A - Method for implementing compatibility between WAPI protocol and 802.1X protocol - Google Patents

Abstract

The invention discloses a method for realizing the compatibility between the WAPI protocol and the 802.1X protocol, so as to solve the problem that non-WAPI terminal stations cannot access the wireless local area network supporting WAPI. The method is: a wireless access point (AP) supporting the WAPI protocol and the 802.1X protocol sends an authentication activation message to the terminal station (STA); the AP judges whether the STA supports the WAPI protocol, and if so, the procedure specified by WAPI between the AP and the STA Perform authentication, otherwise, terminate the WAPI authentication attempt between the AP and the STA, and perform authentication according to the procedures specified in 802.1X.

Description

The Method of Compatibility Between WAPI Protocol and 802.1X Protocol

technical field

The invention relates to wireless local area network technology, in particular to a method for realizing compatibility between WAPI protocol and 802.1X protocol.

Background technique

Wireless local area network (WLAN) is mainly used to transmit Internet Protocol (IP) packet data packets, that is, access point (AP) provides wireless access for user terminals, and then completes the transmission of IP packets through network controllers and connecting devices.

WLAN includes a variety of different technologies. Currently, a widely used technical standard is IEEE802.11b, which uses the 2.4GHz frequency band and has a maximum data transmission rate of up to 11Mbps. Also using this frequency band are IEEE 802.11g and Bluetooth (Bluetooth) technology, among which, the highest data transmission rate of 802.11g can reach 54Mbps. Other new technologies such as IEEE 802.11a and ETSI BRAN Hiperlan2 use the 5GHz frequency band, and the highest transmission rate can reach 54Mbps.

With the rise and development of WLAN technology, WLAN and various wireless mobile communication networks, such as: GSM, code division multiple access (CDMA) system, wideband code division multiple access (WCDMA) system, time division duplex_synchronous code division multiple access The intercommunication between (TD-SCDMA) system and CDMA2000 system is becoming the focus of current research. For WLAN users to access the 3GPP/3GPP2 network, the third generation partnership project (3GPP) and the third generation partnership project 2 (3GPP2) standardization organizations are doing related work.

The 3GPP organization has determined that the EAP-SIM (Extended Authentication Protocol-Subscriber Identity Module) or EAP-AKA (Extended Authentication Protocol-Authentication and Key Agreement) mechanism is used to realize the access interworking between the WLAN network and the 3GPP network.

For the access interworking of WLAN-3GPP2 network, mechanisms such as EAP-AKA and EAP-CAVE are under discussion.

The above methods all adopt the existing access authentication mechanism of 3GPP/3GPP2 to realize the intercommunication of WLAN-3GPP/3GPP2 network.

China has currently formulated a WLAN network access security specification, namely an access authentication mechanism based on the Wireless Local Area Network Authentication and Privacy Infrastructure (WAPI) system. Compatibility between the WAPI mechanism and the 802.11i (802.11i is based on 802.1X) network, especially how an AP supporting WAPI is compatible with different types of STAs is currently a new issue.

WAPI consists of Wireless LAN Authentication Infrastructure (WAI) and Wireless LAN Privacy Infrastructure (WPI). WAI completes the authentication function, and WPI provides the air interface encryption function. The WAPI mechanism uses public key cryptography to authenticate customers. The Authentication Service Unit (ASU) distributes public key certificates to each user.

The format of public key authentication is as follows: Public key certificate version number serial number of the certificate The signature algorithm used by the certificate issuer certificate issuer name Public key information of the certificate issuer The validity period of the certificate certificate holder name Public key information of the certificate holder certificate type reserved text The certificate issuer's signature on the certificate

The meanings of some fields in the table are as follows:

Serial number of the certificate: Each public key certificate issued by ASU needs to be assigned a unique number.

Signature algorithm used by the certificate issuer: specifies the signature algorithm used by the certificate issuer, including the name of the signature algorithm, signature length, and the length of the public key used by the signer.

The certificate's issuer name specifies the identity of the issuer.

The certificate holder name specifies the identity of the certificate holder.

Certificate type: Indicates the device type of the certificate holder, that is, WLAN terminal station (STA), AP or ASU.

Certificate issuer's signature on the certificate: This field is obtained by the certificate issuer signing all field items on the certificate.

The specific process of WAI is shown in Figure 1:

(1) The AP sends an authentication activation message to the WLAN terminal (here referred to as the STA).

(2) After receiving the authentication activation message, the WLAN terminal sends the public key certificate of the WLAN client to the AP through an access authentication request message.

(3) After the AP receives the access authentication request message sent by the WLAN client, it extracts the certificate of the WLAN client, and encapsulates it together with the public key certificate of the AP itself and the signature of the AP in the certificate authentication request message, and sends it to ASU.

(4) After receiving the certificate authentication request message, the ASU verifies the signature of the AP and the validity of the AP certificate. If it is incorrect, the authentication process fails; otherwise, further verifies the certificate of the WLAN client.

(5) The ASU sends the WLAN client certificate verification result, the AP certificate verification result and the signature of the ASU to form a certificate verification response message to the AP.

(6) The AP performs signature verification on the certificate authentication response returned by the ASU, obtains the authentication result of the WLAN client, and performs access control on the WLAN client according to the result (that is, when the WLAN client authentication is successful, the WLAN client is allowed to access; Otherwise, reject the WLAN client to access). At the same time, the AP sends the certificate authentication response to the WLAN client, and the WLAN client verifies the signature of the ASU to obtain the authentication result of the AP. AP; otherwise, the WLAN client does not access from the AP).

(7) The WLAN client negotiates with the AP to obtain the key used for air interface encryption.

WLAN network access authentication of WLAN clients uses the WAI mechanism. In this case, the ASU issues a public key digital certificate to each WLAN client, and the WLAN client uses the public key certificate to identify itself. After the WLAN client passes the WAI authentication, it can access the Internet or other private networks. When the WLAN client accesses the WLAN, the air interface is encrypted using the WPI mechanism to protect the communication security of the WLAN network.

For STAs that do not support WAPI, such as WLAN users roaming from other countries to China, their terminals do not support and cannot recognize WAPI messages. Activate" message, at this time, further authentication and encryption negotiation cannot be performed, resulting in the terminal being unable to access the WAPI network.

Like the current GSM/CDMA network, WLAN must support roaming to meet the access needs of domestic and overseas users if it is operated. When WLAN must adopt the WAI authentication system, how to be compatible with non-WAPI STAs is an urgent problem to be solved at present.

Contents of the invention

The invention provides a method for realizing the compatibility between the WAPI protocol and the 802.1X protocol, so as to solve the problem that non-WAPI terminal stations cannot access the WLAN supporting WAPI.

In order to solve the above problems, the present invention provides the following technical solutions:

A method for realizing compatibility between WAPI protocol and 802.1X protocol, the method comprises steps:

The wireless access point (AP) supporting the WAPI protocol and the 802.1X protocol sends an authentication activation message to the terminal station (STA);

The AP judges whether the STA supports the WAPI protocol. If yes, the AP and the STA perform authentication according to the procedure specified by WAPI. Otherwise, the AP and the STA terminate the WAPI authentication attempt and perform authentication according to the procedure specified by 802.1X.

According to the method above:

When the STA judges that the local end cannot recognize the received authentication activation message, it actively sends a message to the AP to start the EAP authentication process, and the AP judges that the STA does not support the WAPI protocol based on the message.

When the AP has not received the WAPI response message from the STA when sending authentication activation messages for a predetermined number of times, it judges that the STA does not support the WAPI protocol, and actively sends an EAP request message to the STA to start the EAP process; when the AP sends a start EAP authentication message to the STA If the process reaches the predetermined number of times and still does not receive a response from the STA, the process is terminated and the access is rejected.

During the authentication process, the AP and STA generate keys and negotiate encryption algorithms.

In the process authentication process specified by 802.1X, other authentication processes based on EAP are also carried; the other authentication processes include the EAP-SIM and EAP-AKA processes of the WLAN and GSM/WCDMA fusion protocol.

By enhancing the intelligent processing capability of the AP, the present invention has a capability identification function for STAs, and performs corresponding authentication and encryption processes according to the capabilities of the STAs, thereby facilitating the access of various types of users.

By adopting the present invention, after the WAPI standard is enforced in China and the network is fully upgraded, if domestic old users do not have time to upgrade their terminals, they can also access the network.

For foreign roaming users, international roaming cannot be realized according to the existing WAPI method, and the present invention can help operators solve the problem of how WAPI supports international roaming, so as to realize the collection of network usage fees for international roaming users.

Description of drawings

Fig. 1 is a flow chart of terminal station access identification supporting WAPI in the prior art;

FIG. 2 is a schematic diagram of a state machine of an enhanced AP according to Embodiment 1 of the present invention;

FIG. 3 is a flow chart of terminal site access authentication in Embodiment 1 of the present invention;

Figure 4 is a flow chart of EAP-SIM authentication;

Figure 5 is a flow chart of EAP-AKA authentication;

FIG. 6 is a schematic diagram of a state machine of an enhanced AP according to Embodiment 2 of the present invention;

FIG. 7 is a flow chart of terminal site access authentication in Embodiment 2 of the present invention.

Detailed ways

After China enforces the Wireless Local Area Network Authentication and Privacy Infrastructure (WAPI) standard, if all wireless access points (APs) in the wireless local area network (WLAN) are upgraded to support WAPI, a large number of existing terminal stations (STAs) will To access the WAPI network, it must also be upgraded to support WAPI. For STAs that have not upgraded or roamed from abroad, they cannot access the WAPI network.

The present invention adds a method for automatically identifying STAs in the AP, and judges whether the STA supports WAPI through the content of the message. If the AP sends a WAPI message to the STA, it does not receive a WAPI message response, and it receives an 802.1X message. The STA does not support WAPI, but can support 802.1X, so the 802.1X authentication and encryption process is started.

When the STA does not support the WAPI function, the 802.1X authentication process between the STA and the AP can be initiated by the STA or the AP. These two methods will be described separately below.

As shown in Figure 2, add a processing branch in the AP protocol processing state machine to enhance the function of the AP (see the box for the added part), so that the AP not only supports WAPI, but also supports 802.1X (802.1X is a kind of protocol formulated by IEEE). Security protocol, currently 802.11i is based on 802.1X.). For terminal stations (STAs) that support WAPI, they go through the normal WAPI authentication and encryption process when they access, and for STAs that do not support WAPI, they actively start the 802.1X authentication process according to the default configuration.

Referring to Figure 3 and combined with Figure 2, the specific processing flow is as follows:

(1) Regular negotiation between STA and AP, including Probe, Authentication and Association three-way handshake process.

(2) After the association is established, the AP supporting the WAPI function sends an authentication activation message to the ST.

(3) After the WLAN terminal (STA) receives the authentication activation message, if the STA itself supports the WAPI function, it will go through the normal WAPI authentication and encryption process (as shown in Figure 1).

(4) If the STA does not support WAPI, it cannot recognize the authentication activation message. At this time, the STA will start the 802.1X process according to the default configuration, and actively initiate an EAPoL_Start (EAP over LAN protocol_start) message to the AP to start EAP authentication.

(5) Since the AP supports the WAPI protocol and the 802.1X protocol, the AP learns that the STA does not support WAPI according to the EAPoL_Start message of the terminal, and thus starts to perform authentication according to 802.1X.

During the authentication process according to the 802.1X protocol, if a key is generated and a corresponding encryption algorithm is negotiated, encryption (WEP, TKIP or AES) is started between the STA and the AP.

According to the WLAN authentication process defined by 3GPP/3GPP2, EAP-SIM and EAP-AKA processes can also be carried during the 802.1X authentication process. The EAP-SIM and EAP-AKA processes are the integration processes of WLAN and GSM/WCDMA defined by 3GPP (see 3GPP protocol TS 23.234 for details). The interface points between EAP-SIM and EAP-AKA two processes and the present invention are: EAP Request/Identity message.

The EAP-SIM process is the implementation process of WLAN and GSM/GPRS integration defined by 3GPP. The SIM authentication process is carried by 802.1X, so as to realize the purpose of user authentication and billing through the SIM card. The process of carrying EAP-SIM in the 802.1X authentication process is shown in Figure 4 (step 1 in Figure 4 is the three-way handshake process between the STA and the AP).

The EAP-AKA process is a process defined by 3GPP. The CAVE authentication process is carried by 802.1X, so as to realize the purpose of user authentication and billing through the USIM card, as shown in Figure 5 (step 1 in Figure 5 is STA and AP The three-way handshake process).

Referring to Figure 6, in the AP protocol processing state machine, a follow-up processing flow is added to the non-response message to enhance the function of the AP (the added part is shown in the dashed box), so that the AP not only supports WAPI, but also supports 802.1X. When the AP sends "authentication activation" and does not receive a WAPI response message until the authentication times out, it considers that the terminal does not support WAPI, and the AP actively sends an EAP Request/Identity message to the STA to try to start the 802.1X authentication process; if received STA’s EAP response message, then continue the 802.1X process between the AP and the STA; if no response is received and the authentication has not timed out, it will be resent according to the plan; if no response is received until the authentication timeout, the process will be terminated and the access will be rejected .

Refer to 7, the specific process is as follows:

(1) Regular negotiation between the STA and the AP, including the three-way handshake process of Probe, Authentication and Association.

(2) After the association is established, the AP supporting the WAPI function sends an authentication activation message to the ST.

(3) If the AP receives the WAPI response message within the specified time interval, it indicates that the STA supports the WAPI function, and then goes through the normal WAPI authentication and encryption process (as shown in Figure 1).

(4) If the AP side has not received a response message from the STA, and still does not receive a response message after several retransmissions according to the default configuration, it is determined that the STA does not support WAPI messages, terminates the WAPI process, and sends an EAP Request/ Identity message to STA, start to authenticate according to 802.1X.

(5) If the latter process can be carried out normally, according to the WLAN authentication process defined by 3GPP/3GPP2, during the 802.1X authentication process, the protocol carried by EAP includes EAP-SIM, EAP-AKA and other processes.

During the 802.1X authentication process, if a key is generated and a corresponding encryption algorithm is negotiated, encryption is started between the STA and the AP.

(6) If after the AP sends the EAP Request/Identity message, there is still no normal response from the STA, then the authentication process is terminated and the access is refused.

By enhancing the intelligent processing capability of the AP, the present invention has a capability identification function for STAs, and performs corresponding authentication and encryption processes according to the capabilities of the STAs, thereby facilitating the access of various types of users. After the network is fully upgraded, old domestic users can still access the network if they have not had time to upgrade their terminals; foreign roaming users cannot achieve international roaming according to the WAPI method. At this time, if the AP has intelligent processing functions, it can greatly facilitate them. access and roaming. By adopting the invention, the operator can solve the problem of how to support international roaming, thereby charging the network usage fee of the international roaming user.

Claims (7)

1, a kind of method that realizes WAPI agreement and 802.1X agreement compatibility, it is characterized in that the method comprises steps: The wireless access point (AP) supporting the WAPI protocol and the 802.1X protocol sends an authentication activation message to the terminal station (STA); The AP judges whether the STA supports the WAPI protocol. If so, the AP and the STA perform authentication according to the procedure specified by WAPI. Otherwise, the AP and the STA terminate the WAPI authentication attempt and perform authentication according to the procedure specified by 802.1X. 2. The method as claimed in claim 1, wherein when the STA judges that the local end cannot recognize the received authentication activation message, it actively sends a message to the AP to start the EAP authentication process, and the AP judges that the STA does not support WAPI according to the message protocol. 3. The method as claimed in claim 1, characterized in that, when the AP has not received the STA's WAPI response message when it has sent the authentication activation message for a predetermined number of times, it judges that the STA does not support the WAPI protocol, and actively sends a message to the STA. EAP request message to start the EAP process. 4. The method as claimed in claim 3, wherein when the AP sends a response to the STA to start the EAP authentication process for a predetermined number of times and has not received a response from the STA, the process is terminated and the access is refused. 5. The method according to any one of claims 1 to 3, wherein the AP and the STA generate a key and negotiate an encryption algorithm during the authentication process. 6. The method according to claim 5, characterized in that other authentication processes based on EAP are carried during the process authentication process specified by 802.1X. 7. The method according to claim 5, wherein the other authentication procedures include EAP-SIM and EAP-AKA procedures of the WLAN and GSM/WCDMA fusion protocol.

Images